CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day

CVE-2026-50661 (TL-2026-1346) is a medium-severity software vulnerability scored CVSS 6.1, first published 2026-07-15. It has no confirmed attribution, affects Microsoft Windows 10, references 4 CVEs (CVE-2026-50661, CVE-2026-45585, CVE-2026-50507), maps to 18 MITRE ATT&CK techniques (T1003.004, T1005, T1068), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-1346

Threat ID
TL-2026-1346
Severity
MEDIUM
CVSS
6.1 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, legal, manufacturing, education, retail
Target regions
North America, Europe, Asia Pacific, Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in CVE-2026-50661

Malware and tooling: chntpw, manage-bde

A publicly disclosed protection-mechanism failure in Windows BitLocker allows an attacker with physical access to a powered-off or seized device to bypass device encryption and access data on the system drive without the PIN, password, or recovery key. Disclosed via coordinated disclosure ahead of Microsoft's July 2026 Patch Tuesday; Microsoft rates exploitation 'Less Likely' and no active exploitation has been confirmed as of publication.

How CVE-2026-50661 works

CVE-2026-50661 is a security feature bypass vulnerability in Windows BitLocker Device Encryption, tracked under CWE-693 (Protection Mechanism Failure) rather than a classic memory-corruption or code-execution class. The flaw permits an attacker who has physical possession of a powered-off or seized Windows system to circumvent BitLocker's authentication gate and obtain access to the encrypted system volume without supplying the BitLocker PIN, password, or 48-digit recovery key. Microsoft's CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a Physical attack vector with Low complexity, no privileges required, and no user interaction, yielding a 6.1 MEDIUM score driven down primarily by the physical-access precondition rather than by any mitigating technical control.

The vulnerability was disclosed by an anonymous researcher through coordinated disclosure and is not associated with a named public exploit brand, distinguishing it from the related 'YellowKey' BitLocker bypass (disclosed under CVE-2026-45585 in May 2026 as an advisory-only mitigation and subsequently formally patched under CVE-2026-50507 in June 2026), which abused Windows Recovery Environment (WinRE) NTFS transaction-log handling — placing a malicious `FsTx` folder in `System Volume Information` to delete `winpeshl.ini` so WinRE drops to `cmd.exe` instead of the locked recovery UI, after the operating volume has already been transparently decrypted by the TPM. YellowKey has three physical delivery paths: (1) USB stick with a crafted FsTx folder plus a SHIFT+Restart keystroke combination, (2) direct EFI System Partition modification requiring admin rights or brief console access, and (3) drive removal, external modification on another host, and reinstallation — the path most relevant to stolen-device scenarios. The public YellowKey exploit only defeats TPM-only configurations; the researcher has claimed a PIN-defeating variant exists but has deliberately withheld it.

CVE-2026-50661 continues a pattern of BitLocker protection-mechanism failures reported across 2026 that target the boot-time trust chain rather than the AES-XTS cryptography itself — a lineage that includes the earlier 'bitpixie' (CVE-2023-21563) PXE-soft-reboot Volume Master Key (VMK) memory-retention bug. Bitpixie's two-stage attack crafts a modified Boot Configuration Data (BCD) file to trigger a PXE soft reboot into an attacker-controlled Linux environment delivered via TFTP/DHCP with an initramfs signed for Secure Boot; once booted, a memory scanner locates the VMK in RAM using the needle pattern `-FVE-FS-` followed by version bytes and the marker `03 20 xx 00`, after which the `chntpw` utility modifies the Windows SAM database to add an attacker account to Administrators. Bitpixie affects Windows Boot Manager builds from 2005 through 2022 and remains exploitable against patched systems via downgrade attacks that reintroduce an older, still-trusted (but unpatched) boot manager — the root issue is that only PCR7 (Secure Boot state) rather than PCR4 (bootloader binary hash) is measured into the TPM PCR policy used to unseal the key. Microsoft's May 2023 KB5025885 update began introducing the Windows UEFI CA 2023 certificate as a long-term remediation path, with the legacy Windows Production PCA 2011 certificate slated to expire in June 2026, forcing a mandatory certificate-authority rollout across the Windows boot ecosystem in 2026.

This 2026 BitLocker bypass lineage sits within a much longer decade-plus history of physical-access attacks against BitLocker: cold-boot memory-remanence attacks (Princeton, 2008), Secure Boot bit-flip exploits (2013), DMA/Thunderbolt key-extraction attacks (2020), low-cost TPM-bus sniffing using ~$4 Raspberry Pi Pico hardware (2024), and the WinRE-based CVE-2022-41099 / 'BitUnlocker' class of flaws (2022-2025) that, like YellowKey, abused the Windows Recovery Environment to reach a decrypted volume without the key.

Microsoft assesses CVE-2026-50661 as 'Exploitation Less Likely' primarily due to the physical-access precondition — the device must be powered off or otherwise seized and the attacker must interact with boot or recovery workflows — but rates the confidentiality and integrity impact as High because a successful bypass exposes the full contents of an encrypted system drive. The vulnerability affects the entire supported Windows client and server matrix: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, and 2025. Microsoft shipped fixes as part of the July 2026 Patch Tuesday cumulative updates (KB5099535, KB5099538, KB5099539, KB5099540, KB5101649/KB5101650), which was a record-setting release addressing 622 unique CVEs in total — more than triple the roughly 200 CVEs in June 2026's prior record — of which 416 affected Windows and 95 were remote-code-execution bugs. The release included two actively-exploited zero-days receiving higher remediation priority than CVE-2026-50661 despite its own zero-day status: an unauthenticated SharePoint Server elevation-of-privilege flaw (CVE-2026-56164, credited to Mandiant and Google's FLARE team) and a locally-exploitable AD FS privilege-escalation flaw (CVE-2026-56155, identified by Microsoft's DART incident-response unit). Other critical flaws in the same release included a 9.9-severity VMSwitch RCE (CVE-2026-57092), a 9.8-severity SharePoint Server RCE (CVE-2026-50522), and a 9.6-severity Exchange Server stored XSS (CVE-2026-55008); July 14, 2026 also marked end-of-extended-support for SharePoint Server 2016 and 2019.

Threat relevance centers on physical-possession scenarios: stolen or lost laptops, unattended workstations in shared or public spaces, border-crossing device seizures, third-party repair/refurbishment workflows, and compromised branch-office or field-deployed hardware where devices routinely leave organizational custody. Organizations relying solely on TPM-only BitLocker protectors (the Windows default, which unseals the VMK automatically at boot without requiring user secret entry) are most exposed, since — consistent with the pattern seen across YellowKey, bitpixie, and this new CVE-2026-50661 — pre-boot authentication (TPM+PIN or TPM+startup-key protectors) interrupts the automatic unseal-and-boot flow that these protection-mechanism-failure bypasses depend on. Defensive-control effectiveness varies sharply by control: a BitLocker startup PIN is rated highly effective against the public YellowKey exploit (at the cost of user friction and helpdesk burden); a BIOS/UEFI password is ineffective because it does not block the drive-removal-and-reinstall path; monitoring `FsTx`-style staging directories can detect USB-based staging but fails against external, off-host modification; and tamper-evident chassis seals help limit classic 'evil maid' scenarios but require physical-security infrastructure most organizations lack.

MITRE ATT&CK techniques used in TL-2026-1346

Credential Access

T1003.004 LSA Secrets; T1556 Modify Authentication Process; T1649 Steal or Forge Authentication Certificates

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1098.007 Additional Local or Domain Groups

Discovery

T1082 System Information Discovery

Initial Access

T1200 Hardware Additions

Defense Evasion

T1211 Exploitation for Stealth

Persistence

T1542.001 System Firmware; T1542.005 TFTP Boot

defense-impairment

T1553.005 Mark-of-the-Web Bypass; T1601.002 Downgrade System Image

Impact

T1561.001 Disk Content Wipe; T1565.001 Stored Data Manipulation

Execution

T1569.002 Service Execution

Reconnaissance

T1596.005 Scan Databases

Affected products and versions in CVE-2026-50661

  • Microsoft — Windows 10
    Vulnerable versions: 1607; 1809; 21H2; 22H2
    Fixed in: 1607 with KB5099535; 1809 with KB5099538; 21H2/22H2 with KB5099539
  • Microsoft — Windows 11
    Vulnerable versions: 24H2; 25H2; 26H1
    Fixed in: 24H2/25H2/26H1 with KB5101649 or KB5101650
  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022; 2025
    Fixed in: 2016 with KB5099535; 2019 with KB5099538; 2022 with KB5099540; 2025 with KB5101649/KB5101650

Remediation for CVE-2026-50661

Patches

  • KB5099535 — Windows 10 v1607 / Windows Server 2016
  • KB5099538 — Windows 10 v1809 / Windows Server 2019
  • KB5099539 — Windows 10 v21H2/v22H2
  • KB5099540 — Windows Server 2022
  • KB5101649 / KB5101650 — Windows 11 (24H2/25H2/26H1) / Windows Server 2025

Immediate actions

  • Apply Microsoft's July 2026 cumulative updates matching each affected build: KB5099535 (Windows 10 1607 / Server 2016), KB5099538 (Windows 10 1809 / Server 2019), KB5099539 (Windows 10 21H2/22H2), KB5099540 (Windows Server 2022), KB5101649/KB5101650 (Windows 11 / Server 2025)
  • Switch BitLocker protectors from TPM-only to TPM+PIN (or TPM+startup key) on high-value and mobile endpoints to require pre-boot authentication
  • Enforce full-disk pre-boot authentication policy via Group Policy (Require additional authentication at startup) on laptops and field-deployed hardware
  • Verify related YellowKey (CVE-2026-45585 advisory / CVE-2026-50507 patch) and bitpixie (CVE-2023-21563) mitigations are also applied, since all three are frequently exploitable via the same TPM-only-protector weakness

Workarounds

  • Configure TPM+PIN startup authentication via `manage-bde -protectors -add C: -TPMAndPIN` or Group Policy to require a PIN before boot, preventing automatic VMK unseal on physical possession
  • Physically secure or disable unattended devices; restrict device custody transfer (repair, loaner, travel) until patched
  • Where operationally acceptable, disable WinRE or restrict its recovery entry points on high-risk field devices, accepting the loss of F11 system-repair and remote-recovery functionality

Longer-term hardening

  • Enable Secure Boot with an up-to-date DBX revocation list and enforce PCR4 (bootloader binary) measurement in addition to PCR7 (Secure Boot state) in TPM PCR policy to close boot-chain downgrade paths
  • Deploy hardware-backed key storage (TPM 2.0) with startup PIN mandated by policy across the fleet
  • Establish an asset-recovery / chain-of-custody process for lost, stolen, or seized devices that assumes BitLocker-encrypted drives may be compromised until re-imaged
  • Track Windows Recovery Environment (WinRE) and boot-manager related CVEs given the recurring 2026 pattern of BitLocker protection-mechanism bypasses (YellowKey, bitpixie-class attacks, CVE-2026-50661)
  • Plan for the mandatory 2026 Windows boot-chain certificate rollout (Windows UEFI CA 2023 replacing the expiring Windows Production PCA 2011 certificate) introduced via KB5025885
  • Deploy tamper-evident seals on chassis/drive bays for high-value or field-deployed hardware to raise the cost of 'evil maid' drive-removal attacks
  • Instrument endpoint telemetry to monitor for anomalous WinRE invocation and staging artifacts in System Volume Information / FsTx-style directories

CVEs associated with CVE-2026-50661

CVE-2026-50661, CVE-2026-45585, CVE-2026-50507, CVE-2023-21563

Weaknesses (CWE) in CVE-2026-50661

CWE-693

Timeline of CVE-2026-50661

  • Princeton researchers publish the original cold-boot memory-remanence attack against full-disk-encryption key material, establishing the physical-access attack class that BitLocker bypasses continue to belong to.
  • Microsoft ships KB5025885, beginning introduction of the Windows UEFI CA 2023 certificate as long-term remediation for boot-manager downgrade attacks (bitpixie-class), ahead of the June 2026 expiry of the legacy Windows Production PCA 2011 certificate.
  • Security researchers demonstrate low-cost TPM-bus sniffing attacks against BitLocker using ~$4 Raspberry Pi Pico hardware, extending the physical-access bypass lineage that includes DMA/Thunderbolt key extraction (2020) and Secure Boot bit-flip exploits (2013).
  • Eclypsium and SOC Prime publish technical analysis of the 'YellowKey' BitLocker bypass (advisory tracked as CVE-2026-45585), detailing abuse of WinRE NTFS transaction-log handling (FsTx directory) to reach a `cmd.exe` shell on an already-decrypted volume.
  • Microsoft ships the formal YellowKey patch under CVE-2026-50507 as part of the June 2026 Patch Tuesday release, following the May advisory-only mitigation guidance issued under CVE-2026-45585.
  • Microsoft's July 2026 Patch Tuesday ships fixes for CVE-2026-50661 (KB5099535, KB5099538, KB5099539, KB5099540, KB5101649/KB5101650) as part of a record release addressing 622 unique CVEs — more than triple June 2026's prior record of ~200 — including two actively exploited zero-days (CVE-2026-56164 SharePoint, CVE-2026-56155 AD FS) and other critical flaws (CVE-2026-57092 VMSwitch RCE 9.9, CVE-2026-50522 SharePoint RCE 9.8, CVE-2026-55008 Exchange stored XSS 9.6); SharePoint Server 2016/2019 also reach end-of-extended-support this date.
  • TL-Intel Harness ingests the disclosure and opens tracking as TL-2026-1346, noting broad platform coverage and requirement for layered mitigation (pre-boot PIN, Secure Boot enforcement, hardware-backed key storage) beyond the vendor patch alone.
  • Microsoft rates CVE-2026-50661 exploitability as 'Exploitation Less Likely' due to the physical-access precondition; MSRC lists CVSS 3.1 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
  • CVE-2026-50661 publicly disclosed and reported by Cyber Security News; BitLocker Security Feature Bypass affecting Windows 10, Windows 11, and Windows Server 2016-2025 via coordinated disclosure by an anonymous researcher.

Sources cited for CVE-2026-50661

Threats related to CVE-2026-50661

Detection coverage for TL-2026-1346

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1346 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats